release: bump apps/cli to v0.5.16

[baixiaohang]

Summary

• Bump the source-tree CLI version from 0.5.15 to 0.5.16.
• Keep the source package identity as first-tree-dev; GitHub Actions remains responsible for the production package rewrite and npm trusted publishing.
• Reserve the matching stable release coordinate v0.5.16 for the changes merged to GitHub main after v0.5.15.

Draft GitHub Release

Title: v0.5.16 — GitLab attention, Kimi runtime, Context review and audit

Draft release notes

Highlights

• Add Kimi Code as a first-class agent runtime provider, including capability detection, configuration surfaces, and runtime handling.
• Bring GitLab entity attention alongside GitHub with follow, following, and unfollow CLI commands, connection and identity settings, webhook routing, and native chat cards.
• Ship dedicated Context Tree review and audit skills together with the reusable First Tree QA workflow and cases.
• Add connected Google and GitHub account management plus an install-free quick start for invited team-agent users.

Notable fixes

• Retry transient provider failures even after visible output and report Claude token usage as accurate deltas.
• Align SCM attention semantics, make repository settings provider-neutral, keep renamed chat titles in sync, and improve participant and people-picker interactions.
• Harden OAuth cookie and credential handling while completing landing-campaign conversion measurement and restoring onboarding and growth analytics delivery.

Release preflight

• Base commit: d59c83cbfd5572e11a3f3cdefd1b7df6f92d15b7 (origin/main).
• Final release range after v0.5.15: 58 commits across 453 files, including the landing-campaign conversion work that merged before the release PR.
• Merged source version: 0.5.16; current production npm version: 0.5.15; current staging version: 0.5.16-staging.889.1.
• Confirmed absent before this PR: remote tag v0.5.16, GitHub Release v0.5.16, npm package first-tree@0.5.16, and remote release branch.
• Base-commit GitHub CI, CodeQL, Docker, and staging npm/portable publishing are all green.
• The release range includes migrations 0077 through 0081; they are already merged on main, whose Docker build and production deployment completed successfully.
• Formal cross-surface QA was not run for this release cut. The merged range adds reusable QA cases for Kimi Code, GitLab attention, connected accounts, onboarding, and SCM attention parity.

Verification

• pnpm install --frozen-lockfile — passed.
• pnpm check — passed with the repository's existing 2 warnings and 1 informational diagnostic.
• pnpm typecheck — passed.
• git diff --check — passed.
• pnpm test — not run because the release PR changes only package metadata; the base commit's full GitHub CI is green and this PR will rerun the complete gate.

Post-merge

1. Resolve the release PR merge commit and wait for main CI, Docker, and staging npm/portable publishing.
2. Reconcile these notes against the final merged range.
3. Obtain maintainer confirmation of the exact version, tag, target SHA, release title, and release body.
4. Create GitHub Release v0.5.16 at that exact SHA and verify production npm, portable assets, Docker publishing, and the website changelog rebuild.

[yuezengwu]

Post-merge review (the PR merged while this review was in progress): no blocker found in the PR diff.

Goal and core change: reserve the stable v0.5.16 coordinate by changing only apps/cli/package.json from 0.5.15 to 0.5.16, while retaining the source identity first-tree-dev so the production package rewrite remains CI-only.

Verified at review time:

• The diff is exactly the intended one-line version change; git diff --check passes and there are no remaining source references to 0.5.15.
• PR CI, tests, CodeQL, migration validation, and Portable CLI Smoke are green.
• The original preflight range is correctly reported as 54 commits / 452 files, with migrations 0077–0081 present.
• v0.5.16, the GitHub Release, and first-tree@0.5.16 were absent; stable npm remained 0.5.15 and staging was 0.5.16-staging.889.1.
• The merged source state is first-tree-dev@0.5.16 at 6cdd4cf16826cd4ef8c33975726a8b3907c36021.

Because main advanced before this PR merged, the final v0.5.15..6cdd4cf1 range is now 58 commits / 453 files and includes the landing-campaign conversion work. Please perform the PR's stated post-merge release-note/range reconciliation and wait for main CI, Docker, and staging publishing before creating the tag/release.

Human DB check is still required for this release range (not introduced by this metadata-only PR): migrations 0077–0081 include the auth-identity uniqueness change, new GitLab connection/attention tables, and migration 0080's drops of three GitLab audit tables plus related columns. The PR reports these migrations already deployed successfully on main; please still confirm the rollout/recovery boundary before the stable tag.

[yuezengwu]

The final-range reconciliation now looks correct: 58 commits / 453 files, and the landing-campaign conversion work is represented in the notes.

One factual preflight inconsistency remains after merge:

Current source and production npm version: 0.5.15

GitHub main now contains first-tree-dev@0.5.16; only the production npm package remains first-tree@0.5.15 (staging is still 0.5.16-staging.889.1). Please split that line before using this body for final release confirmation, for example:

Merged source version: 0.5.16; current production npm version: 0.5.15; current staging version: 0.5.16-staging.889.1.

At this check, the v0.5.16 tag and GitHub Release are still absent.